Skip to main content

#FOEIndiaSeries | 10. Privacy and Rights-Based Legislation

Free Speech in India

This is one of 14 articles (available via this page) through which I hope to share a sense of free speech and content law in India. Part I of this series considers the socio-legal basis of free speech law in India, Part II explores what regulation, both legal and social, says and, in some cases, what it should perhaps say while Part III, finally, looks at the processes through which free speech regulation is implemented in India.

Wherever possible, I've tried to avoid mention of matters I've been involved in myself. I've also tried to ensure that the series is accessible to non-lawyers.

The terms ‘child pornography’ and 'revenge porn' have been used simply because of how common they are, both in popular discourse and occasionally at law, even though neither term is accurate. 'Child porn' refers to indecent images of children and, where real children feature, is evidence of child abuse in and of itself. 'Revenge porn' generally refers to the non-consensual release of explicit imagery of a woman by a former partner of hers. It, too, is a manifestation of abuse, and is far more an expression of power than an expression of pornography.

Of course, none of the content of these articles is professional advice and it should not be relied on for any purpose. It is tinged with personal opinion, may not be accurate, and is incomplete.  

Posts in this Series

Part I.    The Foundations of the Law

1.    The Parameters of Indian Discourse    
2.    The Backbone of the Law    
3.    Legislative and Other Input

Part II. Regulating the Substance of Speech    

4.    Creative Content and Trade    
5.    Reputation and Honour    
6.    Keeping the State Functional    
7.    Maintaining Law in a Plural State    
8.    Women’s Existence in Patriarchy
9.    Sexual Abuse and Reportage
10.    Privacy and Rights-Based Legislation    
11.    Explicit Content: Choice, Consent and Coercion    
12.    State Paternalism and Public Interest

Part III.  The Processes of the Law    

13.    Keeping Track of Others’ Content
14.    The Mechanics of Regulation

Part II. Regulating the Substance of Speech

10. Privacy and Rights-Based Legislation

In 2012, the 1957 Copyright Act was significantly amended, amongst other reasons, to address inequities in the film and television industry which often saw writers and musicians being exploited. It did this not by creating greater freedom of choice and contract but by restructuring the law so that writers, musicians, and performers would have a legal right to a share of the royalties accrued by the film or the sound recording in which they featured provided that they met specified statutory criteria. The experience demonstrated that were the playing field is uneven, the best way in which to address the problem is to create a situation where those who are disadvantaged have rights which are protected by law, which cannot be taken away from them, and which they cannot be 'persuaded' to 'choose' to relinquish.

To create equitable situations, relying on the so-called free market, choice, or the supposed freedom to contract simply does not work well where the power dynamics between the parties to a negotiation are so ill-matched that one party can simply dictate terms which the other has no choice but to accept. For the individual, choice is always determined, and often inhibited, by a variety of factors including social structures, financial privilege or the lack of it, gender, and class. And since choice can easily be so inhibited as to be meaningless, it becomes important to create models which are not based on choice but which are based on assuring everyone involved in a specific issue at least minimum rights.

Thus far, when it has come to privacy and informational self-determination, a variety of interests have attempted to push for consent-based models to be adopted, but, as in the case of those who are photographed by people who tend to have greater social and financial capital than themselves, it isn’t always clear that such models are ideal. Although the two — privacy and informational self-determination — are closely linked, they arise from different traditions.

Privacy has a much older history, and is generally legally-recognised with reference to a 19th-century US paper by Brandeis and Warren who conceived of it in terms of the right to be let alone. As opposed to this, the framework to understand informational self-determination was developed over a century later: Alan Westin essentially redefined privacy to describe it as the right of individuals to control their personal information in terms of disclosure, retention, and dissemination while Niklas Luhmann helped to develop a jurisprudential basis for informational self-determination. In essence, he did this by pointing out that keeping the information of individuals separate in distinct societal subsystems, and preventing it from overflowing from one subsystem into another facilitates democratic participation, and has communal benefits.

In India, there was no clear jurisprudence of privacy which had been developed for decades although the courts did repeatedly recognise that individuals have a right to privacy. Nonetheless, case law which dealt with the subject in relation to content and free speech often turned defamation and privacy into kichadi — this was simply a result of the fact that the two issues often came up together. People who claimed that their privacy was violated by specific content also often claimed that they had been defamed by that same content. As such, it was extremely difficult to discern what Indian law had to say in relation to privacy by reading case law alone. And to make matters worse, although several statutes dealt with privacy piecemeal, there were no clear overarching principles which one could rely on to understand how the courts would treat claims that one’s privacy had been violated.

That situation began to change drastically in 2017 when a 9-judge bench of the Supreme Court reiterated, in no uncertain terms, what decades worth of case law had previously suggested: privacy is a fundamental right. Through six largely-concurring judgments, the judges developed what could be considered a comprehensive framework to understand the legal right to privacy in India, and harmonised then-existent case law. The result was that, although privacy would still not be governed by a dedicated statute, there came to be a coherent statement on what it meant in the Indian legal context.

Privacy had already been linked to the right to life encapsulated in Article 21 of the Constitution and to the various freedoms recognised by Article 19 which deals with such issues as the right to trade, and the right to free speech. The 2017 decision of the Supreme Court ‘updated’ this understanding and clarified that the right to privacy is essentially a natural right straddling across the spectrum of fundamental rights all of which are inalienable. If fact, the Court went so far as to describe the existence of privacy as the necessary condition precedent to the enjoyment of any of the fundamental rights. It also recognized the validity of interpreting the Constitution ‘to meet the aspirations and challenges of the present and the future’ and, in doing so, brushed aside arguments relating to originalism along with the ostensible desire to have the document be interpreted in a manner entirely consistent with the intentions of its original drafters.

What was particularly interesting about the judgment, however, was that it didn’t restrict itself to strictly legal interpretation, and lashed out, albeit in an understated manner, at widely accepted cultural norms. It recognized that privacy is not a concern of the elite alone, and implicitly rejected the belief of the concerns of communities or other groups necessarily preceding or superseding the rights of individuals — a belief which many Indians have imbibed possibly due through having spent generations living in joint families allied to closely-knit communities.

The privacy judgment also recognised how important privacy is to those who do not conform to the mainstream or to majoritarian practices; the Supreme Court described privacy as ‘the ultimate expression of the sanctity of the individual’, and held: “…privacy with its attendant values assures dignity to the individual and it is only when life can be enjoyed with dignity can liberty be of true substance."

Despite all of the this, the Court also recognized that the right to privacy is not, and should not be, absolute. Individuals cannot act in whatever manner they please and then claim that their right to privacy allows them to do so. No person can violate zoning restrictions at will, to draw an example from the judgment itself, and then claim that the right to privacy makes such conduct permissible. The State is entirely within its rights to circumscribe privacy. However, it must justify itself when it does so, and it cannot act arbitrarily.

Thus, the Supreme Court’s recognition of the right to privacy strengthened claims to privacy without creating an atmosphere in which claims could be made entirely indiscriminately. It did not affect the operation of provisions existing in disparate statutes dealing with privacy or, in any way, hinder the operation of privacy claims in the realm of tort law where it has primarily been conceived of as the right to be left alone.

In the 1990s itself, the judiciary made determinations relating to privacy which came to form the bedrock of privacy law, so to speak. It ruled that ‘nobody can publish anything regarding the private matters of a citizen including his/her family, marriage, procreation, motherhood, child-bearing and education without his/her consent’ in no uncertain terms. This 'early' understanding appeared to confirm the validity a consent-based model of privacy in which, if persons consented to the publication of material about themselves, they could not later validly complain about such publication.

However, there were also indications from the judiciary that it did not consider the consent-based model to be foolproof. For example, if a woman who agreed to have a biopic made featuring herself alleged that her privacy had been violated by the biopic, her allegation would not immediately be thrust aside simply because of her having granted consent. The grant of consent would not permit the making of ‘a film in total disregard’ of the right to privacy. This indicated that despite its recognition of ‘consent’ as a valid defence to allegations of the invasion of privacy, the judiciary did not consider the defence to be impenetrable, and recognised that a person who granted consent could still retain rights despite the grant of consent.

The general willingness of the judiciary to protect the privacy of individuals did not come without its caveats though. Firstly, the right to privacy did not appear to extend to dead people. Secondly, through case law, there came into being a hierarchy amongst those who could claim the right to privacy. Public officials were considered to have no right to privacy worth mentioning in relation to their official acts, neither could public figures easily claim to have had their privacy be violated by such things as the reportage of their public acts. Those who forced themselves into the public eye, too, were not considered to have a particularly strong right to privacy. And, as such, it was members of the general public who came to enjoy the greatest right to privacy.

Nonetheless, unless it were expressly prohibited by law, it is unlikely that the publication of information already accessible by the public would constitute an invasion of privacy or be considered to have been illegal. So, for example, if the name of a woman who was raped was already widely-known on account of having been leaked by someone, it would still likely not be permissible to report her name. After all, is unlikely that republishing the name of a woman who had been raped could be defended by saying, “It’s anyway available online,” since that is not a defence recognized by Section 228A of the Penal Code which protects the identities of most women rape victims who are raped by men.

Rape itself is not defined as a gender-neutral crime in the Penal Code; only women can be rape victims in terms of Section 375 of the Code which defines the crime. Men who are raped by other men (or, theoretically, women who are raped by other women) could be prosecuted under Section 377 of the Penal Code which criminalises non-consensual 'unnatural acts' by which it is understood to mean homosexual acts and bestiality.

Section 228A lists the crimes in relation to which the disclosure of victim identities is impermissible, and that list does not include Section 377. Thus, under current law, a man who was raped would not be eligible to have his identity protected under Section 228A of the Penal Code although, if his identity were disclosed, it would certainly be open to him to initiate actions not limited to those against the invasion of his privacy. The same would apply to a woman who had been raped in a manner not recognised by the Penal Code's definition of rape.

These days, a large number of invasions of privacy occur not offline, as they traditionally would have done, but online. The law is cognisant of this, and has attempted to address the problem through laws and rules specifically meant to deal with content and conduct online although the success of its attempts has been questionable. Nonetheless, Internet laws create what could be considered an additional degree of protection: they apply in addition to other conventional laws apply to offline content.

The 2000 Information Technology Act contains several provisions which deal with privacy, and, in 2011, subordinate legislation which dealt with privacy was issued under the statute: the Information Technology (Reasonable security practices and procedures and Sensitive Personal Data or Information) Rules.

Amongst the provisions of the Information Technology Act which deal with privacy is Section 72. Under this provision the disclosure of data by persons who secure access to it in pursuance of the powers conferred by the Act is punishable with imprisonment for a term which may extend to two years, or with fine which may extend to one lakh rupees, or with both.

Further, although the bulk of the 2011 Privacy Rules deal with the collection and retention of information, they also contain clauses which deal with disclosure and publication. The Rules have divided information into three categories: ‘Information’ which basically means any content, ‘Personal Information’ which, in essence means information relating to human beings including information which could identify them, and ‘Sensitive Personal Data or Information’ which have been defined as a subset of personal information relating to passwords, financial information, medical information, biometric information. The Rules, however, clarify that ‘any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law’ would not be considered to be Sensitive Personal Data or Information.

The Privacy Rules set out a number of rights and obligations in relation to each type of information; all of them apply to Sensitive Personal Data or Information but they do not uniformly apply to the other forms of information. These obligations relate to the necessity of obtaining consent for collection; letting information providers know about the fact of collection, the reason for collection, and who would receive and store the provided information; ensuring that the collection is required for lawful purposes and restricting its use; limiting the duration for which the provided information may be retained; enabling information providers to review, correct, and withdraw information; setting up minimum requirements for security practices followed to protect the provided information; laying out privacy policies and establishing grievance redressal procedures.

From the point of view of free speech, what is most important may be Rules 6 and 7 of these privacy regulations which deal with the publication, disclosure, and transfer of information. A body corporate does not have the right to publish information but it may transfer information to another body corporate or person which ensures that the information is as well protected as with itself, and if the transfer is required to perform a lawful contract between itself and the information provider.

Also, the disclosure of sensitive personal data or information by a corporate body is permitted in a limited number of circumstances although no person who receives information from it may further disclose such information. The initial disclosure by the body corporate itself generally requires the consent of the information provider unless consent has been previously obtained by it, or the disclosure is required by law. The latter disclosure could be necessitated in circumstances where the company has a legal obligation to disclose information or where it receives a procedurally-correct request from a government agency empowered to make one.

The structure of the Privacy Rules along with a Press Note issued to clarify them indicates that they are intended to cover business-to-consumer interaction and not business-to-business interaction, or, indeed, any other form of interaction. And, as such, even to govern online conduct, they are woefully inadequate.

It isn’t at all uncommon, for example, for individuals to engage in doxing online and publish information about others which is usually some combination of private and personal, and which has the ability to identify the individuals who are targeted. The information may not be private in the sense that could be accessed by the public but it is almost invariably private in the sense that it is not easily accessible by the public. It is also information which the individuals targeted would likely not have wanted to have been made public, and which is collated and made public for the specific purpose of harassing them.

It is far from unheard of for a woman who express opinions about almost anything online to be at the receiving end of a backlash from people who either do not want her to speak at all or people who do not like what she has to say. In both cases, their retaliation may take the form of publicising information about the woman ranging from her sexual history, either real or imagined, to her address and phone number which leaves open the possibility of taking harassment into the physical world from the virtual one online.

Although there exists the possibility of applying various provisions of the law to counter such conduct, there is no dedicated privacy or other law which specifically counters it. Apart from the fact that online harassment potentially poses threats to the well-being of the person who is targeted in and of itself by creating a great deal of stress, doxing has the potential to make the problem exponentially worse by expanding the spectrum of options available to those who choose to harass others. As a general rule, it is those who are already the most marginalised who suffer from this sort of harassment, sometimes without even the protection of social sanction which might otherwise dampen the enthusiasm of those who bully them and worse.

The less opinions conform to societal expectations, the more they and their proponents are liable to be viciously attacked. In a country whose society is deeply divided along the lines of both gender and caste, this invariably means that anyone who speaks against the status quo, against patriarchy, or against the caste hierarchy is subject to attacks which are distinguishable only by how vicious they are.

In a society which is hierarchical with not just broad layers of class forming a pyramid but also with innumerable caste strata embedded into the structure of class almost everyone is committed to maintaining the status quo, and in preserving their own group’s supposed superiority over that of another. It is primarily those who are perceived as being right at the bottom of the pyramid who are, as a group, truly invested in dismantling the entire structure of caste and class. Unfortunately, they do not necessarily have the social or financial capital to make their voices heard, certainly not by limiting themselves to the polite and measured tones which the upper clastes (who do not have to shout to make themselves heard) are used to and find acceptable.

Although online platforms are often considered more democratic than those of traditional media, ostensibly offering all their users a basic degree of access, in practice, their users often form cliques whose members amplify each others’ voices and which tend to replicate social patterns found offline.

It isn’t uncommon to find that upper claste groups often seek to delegitimise anything said by those outside of their own groups either by attacking the substance of what others have to say, or where that fails, by attacking the tone which others use. Their doing so may not necessarily have anything to do with either the tone or content of the speech they attack. Instead, it may, however subconsciously, if one were to be charitable, have everything to do with preserving their own privileges especially since the ascendancy of voices other than their own may be perceived as being complementary to the descent of their own voices.

Having a voice at all is, of course, a mark of privilege. Having a voice which is continually amplified is almost certain to be a mark of a belonging to a group perceived as being in the upper echelons of society.

Being able to speak and be heard is important because having a voice is closely linked to having credibility which, of course, helps facilitate modifying lived realities for oneself, for the groups one belongs to and for the world at large. As such, it isn’t at all surprising that a tremendous effort is often put into silencing people — often, entire groups of people — and keeping them from being able to develop the social capital they would need to have their lives change, to keep themselves from being subject to exploitation, and to be able to make their own choices.

This is, of course, not an issue which is limited to online speech alone. It also pervades almost every realm of life in the ‘real’ world with structures of oppression often overlapping to reinforce each other. In India, a lower caste person is disadvantaged in relation to an upper caste person. Consider gender in addition to caste, and it’ll emerge that a lower caste woman is more disadvantaged than a lower caste man although both of them are generally more disadvantaged than any upper caste person: man, woman, or child. That said, an upper caste woman, although she has more advantages than lower caste people, is almost always less advantaged than an upper caste man. And this, of course, only considers the two factors of caste and gender.

Being able to speak for oneself, to control what information about oneself is shared, and to have a voice is not an elite concern. It is a concern which affects everyone, and violations of privacy have the potential to have life-changing and life-threatening consequences. Indian women tend to rely on privacy, even if not a well-articulated expression of it, to get by in their day-to-day lives to circumvent expectations which a patriarchal society places on them. They may wear mangalsutras to appear to be married, use IUDs to avoid unwanted pregnancies without telling their partners, keep aside some money for emergencies particularly if their husbands are abusive and financially unreliable, lie to avoid having to admit to drinking alcohol, or pretend that their male partners are cousins to avoid censure. This doesn’t necessarily denote a lack of integrity, it certainly isn’t illegal, and it could well simply be a manifestation of prudence.

Nonetheless, anecdata is rife with tales of women being stripped of their privacy in their everyday lives by people who may not even actively intend to do any harm. Banks, for example, do not always hesitate to hand over a woman’s passbook or financial details to male relatives such as fathers and husbands. While that may not ordinarily be personally problematic, it becomes a particular concern where the woman concerned is in an abusive situation; she could well have fled in fear of being killed for ‘honour’ after having eloped with a man of a lower caste unacceptable to her family, to take just one example. In such a case, her financial details could easily give away her location and make it much easier for her natal family to track her down. And, unfortunately, not only do there exist no stringent laws which would help keep her information private, but it is also easy to imagine a situation where a natal family would not find it difficult at all to find people sympathetic to them and willing to share what should be private information, especially if they did not add that they were out to commit murder and only said that they wanted to find the woman ‘for her own good’.

At the heart of the problem is that all adults are not considered equal or to know what is best for themselves. Although the State may not be actively paternalistic in all situations, it is almost undeniable that society is hierarchical, and families often are rabidly patriarchal. This makes it incumbent to have the law explicitly and actively protect those who are most vulnerable, and to ensure that privacy is enthusiastically protected, so as to help achieve the Constitutional aim of a free and egalitarian society where speech is not unjustifiably curbed.

Statutory law has, so far, failed to create legal mechanisms to address the possibility of free speech being suppressed on account of the fear of the invasion of privacy, and society often compounds the failure by routinely invading the privacy of individuals without the slightest consideration for what those individuals may want for themselves or what the consequences could be.

It is because of the mix of legal lacunae, our cultural heritage, the lack of accountability for violations of privacy, and the real damage which such violations can wreak, that it is essential to have a comprehensive legal framework dealing with privacy, data protection, and the permissible publication and disclosure of information. The fact that a comprehensive statutory framework has not come into existence for some seven decades after Independence only highlights the complexities and cultural resistance to having the concerns of individuals take centre stage.

(This post is by Nandita Saikia and was first published at IN Content Law.)